Sulala is a private, verification-first family and tribe lineage platform operated under Forfait Representation of Companies, Abu Dhabi, United Arab Emirates ("we", "us"). Contact: mazen@forfait.me.
Account data (email, name, sign-in provider); the lineage data you and your family contribute (names, relationships, birth years, optional photos, optional nationality and dates); privacy choices per person; consent records; payment records processed by our payment provider (Ziina) — we never store card numbers; optional identity-verification (KYC) results; and technical usage data (screens used, activity log) to operate and improve the service.
To provide the family-tree service you request; to enforce your privacy choices; with your consent (recorded in-app as the Sulala pledge); to process purchases; and for our legitimate interest in keeping the platform safe and accurate (attestation, anti-abuse, audit logs).
Lineage entries are visible only according to their privacy scope: family (members of your house), private (house keeper only), custom (an audience you choose), or public (only if the house keeper deliberately makes the tree public). Entries marked private are excluded from all tree views at the database level. We do not sell personal data. We share data only with processors needed to run the service (Supabase hosting in Frankfurt, EU; Ziina for payments; AI providers receive only your help-chat messages, never your tree).
You may access, correct, or complete your data in-app; take over control of your own entry; withdraw consent; request export; or request deletion of your account and contributed personal data (email us — we honour requests within 30 days, subject to entries other family members hold about themselves). These rights follow UAE Federal Decree-Law No. 45 of 2021 (PDPL).
Accounts are for adults 18+. Entries about minors may only be added by their family with the keeper's approval and default to family-only visibility.
Data is retained while your account is active. Security measures include row-level security on every table, role-based access, attestation-gated changes, audit logging, and encrypted transport. DNA/health features (Helix) are not yet live; no genetic data is collected today, and a separate explicit consent will govern them when launched.
We will post updates here with a new version number and effective date.
This policy is provided for transparency and does not constitute legal advice; it should be reviewed by counsel before large-scale public launch.